Getting Data In

How to configure Splunk Forwarder to NOT index historical data

Builder

Recently we had issues with one of the data inputs which uses rest API add-on, sending a large volume of data.
So I have disabled the three inputs of the data type in the heavy forwarder.
I would like to enable back the inputs but I would like to get the data starting from today.
I assume once I enable it back I would get all the data that was disabled for the few days.
Is there any setting that will get the latest or today's data and where should the setting be placed?

Thanks in advance.

0 Karma
1 Solution

Legend

Hi vrmandadi,
in inputs.conf use the ignoreOlderThan=1d option ( https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf ).
Ciao.
Giuseppe

View solution in original post

0 Karma

Legend

Hi vrmandadi,
in inputs.conf use the ignoreOlderThan=1d option ( https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf ).
Ciao.
Giuseppe

View solution in original post

0 Karma

Builder

Hello @gcusello thank you very much for your reply .Will this setting once enabled today will get only today's data and not the days this inputs were disabled right?

Can we use this input on a index setting ?

0 Karma

Legend

Hi vrmandadi,
You have to use this option in an inputs.conf stanza, e.g.:

[monitor:///var/log/messages]
index=os
sourcetype=linux
ignoreOlderThan=1d

See in the documentation ( https://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf )instructions and samples.

Ciao.
Giuseppe

0 Karma

Builder

Thank You.

0 Karma

Legend

You're welcome!
Ciao and next time.
Giuseppe

0 Karma